@aid-framework/generator-sdk 0.1.57 → 0.1.59

package/dist/eject.js

@@ -0,0 +1,169 @@
+/**
+ * `aid eject` (§10): taking ownership of a generated file.
+ *
+ * Ejection is the developer's answer to the drift rule. When a generated file needs
+ * hand-editing, the choice is to keep discarding the edits with `--force`, or to own the
+ * file. Owning it means two things, and both are required:
+ *
+ *   1. **The bytes move to the business tier.** Ownership is decided by *where a path
+ *      lives* (`ownership.ts`), not by a flag, so flipping ownership is a move from
+ *      `<generatedDir>/x` to `<businessDir>/x`. A manifest flag alone would contradict
+ *      the location rule the planner enforces.
+ *   2. **The generated path is excluded forever.** The manifest records it in `ejected`,
+ *      and `planRegeneration` drops it from every plan. Without this the next `gen` would
+ *      simply recreate the generated file and the edit would be lost again.
+ *
+ * The write order is deliberate: destination first, source second. An interrupted eject
+ * leaves two copies, never zero.
+ *
+ * Two refusals are not negotiable. Ejecting onto a business file with different bytes
+ * would destroy developer-owned content — the one thing the ownership model protects —
+ * so it fails and names the file to move aside. Ejecting a path the manifest never
+ * recorded has nothing to transfer and is refused rather than manufacturing a business
+ * file from an accident.
+ */
+import { manifestRecordFor } from './aid-manifest.js';
+import { sha256Hex, sortByPath } from './determinism.js';
+import { GENERATOR_DIAGNOSTIC_CODES, generatorError, } from './diagnostics.js';
+import { DEFAULT_BUSINESS_DIR, DEFAULT_GENERATED_DIR, normalizeRelativePath, ownerForPath, } from './ownership.js';
+function stripTrailingSlashes(value) {
+    let end = value.length;
+    while (end > 0 && value[end - 1] === '/')
+        end--;
+    return value.slice(0, end);
+}
+/**
+ * The business-tier home of a generated path: `<generatedDir>/a/b.py` becomes
+ * `<businessDir>/a/b.py`. Returns `undefined` for anything that is not a file directly
+ * beneath the generated root, so a caller cannot "eject" a directory or a foreign path.
+ */
+export function businessPathFor(path, options = {}) {
+    const normalized = normalizeRelativePath(path);
+    if (normalized === undefined)
+        return undefined;
+    const generatedDir = stripTrailingSlashes(options.generatedDir ?? DEFAULT_GENERATED_DIR);
+    const businessDir = stripTrailingSlashes(options.businessDir ?? DEFAULT_BUSINESS_DIR);
+    if (!normalized.startsWith(`${generatedDir}/`))
+        return undefined;
+    const rest = normalized.slice(generatedDir.length + 1);
+    if (rest === '')
+        return undefined;
+    return `${businessDir}/${rest}`;
+}
+function refuse(diagnostic) {
+    return { ok: false, diagnostics: [diagnostic] };
+}
+/**
+ * Moves one generated file to the business tier and records a permanent exclusion.
+ *
+ * Idempotent by design: ejecting a path that is already developer-owned succeeds with
+ * `status: 'already-owned'`, so a script can call it without first asking whether the
+ * file was ejected.
+ */
+export function eject(request) {
+    const dryRun = request.dryRun ?? false;
+    const path = normalizeRelativePath(request.path);
+    if (path === undefined) {
+        return refuse(generatorError({
+            code: GENERATOR_DIAGNOSTIC_CODES.ejectInvalidPath,
+            message: `"${request.path}" is not a repo-relative path, so it cannot name a generated file.`,
+            path: request.path,
+            hint: 'Pass the path `aid gen` prints, for example `app/generated/prompts/triage.py`.',
+        }));
+    }
+    // Scaffold content is authored once and owned by the developer from then on, so there
+    // is nothing to transfer and nothing to look up. Checked before the manifest guard: the
+    // answer does not depend on the tree ever having been generated.
+    if (ownerForPath(path, request) === 'scaffold') {
+        return { ok: true, status: 'already-owned', from: path, dryRun, diagnostics: [] };
+    }
+    const manifest = request.manifest;
+    if (manifest === undefined) {
+        return refuse(generatorError({
+            code: GENERATOR_DIAGNOSTIC_CODES.ejectNotGenerated,
+            message: 'There is no manifest, so this tree has never been generated and has nothing to eject.',
+            hint: 'Run `aid gen` first; ejection transfers a file the generator wrote.',
+        }));
+    }
+    const record = manifestRecordFor(manifest, path);
+    if (record === undefined) {
+        // A business path the generator never planned is already owned by the developer;
+        // asking to eject it is a no-op, not a mistake. The same is true of a generated path
+        // already in the ledger: the file has moved, so there is no record left, and the
+        // ledger is the only proof the transfer happened. Without this lookup a second eject
+        // would report "not generated" for a file this command ejected itself. Scaffold paths
+        // are handled above, before the manifest guard.
+        if (ownerForPath(path, request) === 'business' || manifest.ejected.includes(path)) {
+            return { ok: true, status: 'already-owned', from: path, dryRun, diagnostics: [] };
+        }
+        return refuse(generatorError({
+            code: GENERATOR_DIAGNOSTIC_CODES.ejectNotGenerated,
+            message: `"${path}" is not recorded in the manifest, so there is no generated artifact to take ownership of.`,
+            path,
+            hint: 'Eject a path the manifest lists as generated; `aid doctor` prints them.',
+        }));
+    }
+    if (record.owner === 'business') {
+        return { ok: true, status: 'already-owned', from: record.path, dryRun, diagnostics: [] };
+    }
+    const to = businessPathFor(record.path, request);
+    if (to === undefined) {
+        return refuse(generatorError({
+            code: GENERATOR_DIAGNOSTIC_CODES.ejectInvalidPath,
+            message: `"${record.path}" has no business-tier counterpart under the configured roots.`,
+            path: record.path,
+        }));
+    }
+    const content = request.sink.read(record.path);
+    if (content === undefined) {
+        return refuse(generatorError({
+            code: GENERATOR_DIAGNOSTIC_CODES.ejectMissingFile,
+            message: `"${record.path}" is recorded as generated but is missing from the tree.`,
+            path: record.path,
+            hint: 'Run `aid gen` to restore it, then eject.',
+        }));
+    }
+    const existing = request.sink.read(to);
+    if (existing !== undefined && existing !== content) {
+        return refuse(generatorError({
+            code: GENERATOR_DIAGNOSTIC_CODES.ejectDestinationExists,
+            message: `"${to}" already exists and differs from "${record.path}"; ejecting would overwrite developer-owned content.`,
+            path: to,
+            hint: 'Move or delete that file yourself, then run eject again.',
+        }));
+    }
+    const written = existing === undefined;
+    if (!dryRun) {
+        if (written)
+            request.sink.write(to, content);
+        request.sink.remove(record.path);
+    }
+    const businessRecord = {
+        path: to,
+        owner: 'business',
+        sha256: sha256Hex(content),
+        generator: record.generator,
+        generatorVersion: record.generatorVersion,
+    };
+    return {
+        ok: true,
+        status: 'ejected',
+        from: record.path,
+        to,
+        written,
+        dryRun,
+        manifest: {
+            manifestVersion: manifest.manifestVersion,
+            generatedBy: manifest.generatedBy,
+            files: sortByPath([
+                ...manifest.files.filter((file) => file.path !== record.path && file.path !== to),
+                businessRecord,
+            ]),
+            // Sorted and de-duplicated: two routes to the same exclusion must not produce two
+            // entries, and a stable order is what makes the manifest byte-comparable.
+            ejected: [...new Set([...manifest.ejected, record.path])].sort(),
+        },
+        diagnostics: [],
+    };
+}
+//# sourceMappingURL=eject.js.map

package/dist/eject.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eject.js","sourceRoot":"","sources":["../src/eject.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAA0C,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC9F,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EACL,0BAA0B,EAE1B,cAAc,GACf,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,EACrB,YAAY,GACb,MAAM,gBAAgB,CAAC;AAOxB,SAAS,oBAAoB,CAAC,KAAa;IACzC,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IACvB,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG;QAAE,GAAG,EAAE,CAAC;IAChD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,OAAO,GAAuB,EAAE;IAEhC,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE/C,MAAM,YAAY,GAAG,oBAAoB,CAAC,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAC,CAAC;IACzF,MAAM,WAAW,GAAG,oBAAoB,CAAC,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC,CAAC;IAEtF,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,YAAY,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACjE,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvD,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAElC,OAAO,GAAG,WAAW,IAAI,IAAI,EAAE,CAAC;AAClC,CAAC;AA4BD,SAAS,MAAM,CAAC,UAA+B;IAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;AAClD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,KAAK,CAAC,OAAqB;IACzC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC;IAEvC,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,MAAM,CACX,cAAc,CAAC;YACb,IAAI,EAAE,0BAA0B,CAAC,gBAAgB;YACjD,OAAO,EAAE,IAAI,OAAO,CAAC,IAAI,oEAAoE;YAC7F,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,gFAAgF;SACvF,CAAC,CACH,CAAC;IACJ,CAAC;IAED,sFAAsF;IACtF,wFAAwF;IACxF,iEAAiE;IACjE,IAAI,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,UAAU,EAAE,CAAC;QAC/C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IACpF,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,MAAM,CACX,cAAc,CAAC;YACb,IAAI,EAAE,0BAA0B,CAAC,iBAAiB;YAClD,OAAO,EACL,uFAAuF;YACzF,IAAI,EAAE,qEAAqE;SAC5E,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAEjD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,iFAAiF;QACjF,qFAAqF;QACrF,iFAAiF;QACjF,qFAAqF;QACrF,sFAAsF;QACtF,gDAAgD;QAChD,IAAI,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,UAAU,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAClF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;QACpF,CAAC;QACD,OAAO,MAAM,CACX,cAAc,CAAC;YACb,IAAI,EAAE,0BAA0B,CAAC,iBAAiB;YAClD,OAAO,EAAE,IAAI,IAAI,4FAA4F;YAC7G,IAAI;YACJ,IAAI,EAAE,yEAAyE;SAChF,CAAC,CACH,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QAChC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IAC3F,CAAC;IAED,MAAM,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACjD,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACrB,OAAO,MAAM,CACX,cAAc,CAAC;YACb,IAAI,EAAE,0BAA0B,CAAC,gBAAgB;YACjD,OAAO,EAAE,IAAI,MAAM,CAAC,IAAI,gEAAgE;YACxF,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,MAAM,CACX,cAAc,CAAC;YACb,IAAI,EAAE,0BAA0B,CAAC,gBAAgB;YACjD,OAAO,EAAE,IAAI,MAAM,CAAC,IAAI,0DAA0D;YAClF,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,0CAA0C;SACjD,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACnD,OAAO,MAAM,CACX,cAAc,CAAC;YACb,IAAI,EAAE,0BAA0B,CAAC,sBAAsB;YACvD,OAAO,EAAE,IAAI,EAAE,sCAAsC,MAAM,CAAC,IAAI,sDAAsD;YACtH,IAAI,EAAE,EAAE;YACR,IAAI,EAAE,0DAA0D;SACjE,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,KAAK,SAAS,CAAC;IACvC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,OAAO;YAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,MAAM,cAAc,GAAoB;QACtC,IAAI,EAAE,EAAE;QACR,KAAK,EAAE,UAAU;QACjB,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC;QAC1B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;KAC1C,CAAC;IAEF,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,SAAS;QACjB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,EAAE;QACF,OAAO;QACP,MAAM;QACN,QAAQ,EAAE;YACR,eAAe,EAAE,QAAQ,CAAC,eAAe;YACzC,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,KAAK,EAAE,UAAU,CAAC;gBAChB,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;gBACjF,cAAc;aACf,CAAC;YACF,kFAAkF;YAClF,0EAA0E;YAC1E,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;SACjE;QACD,WAAW,EAAE,EAAE;KAChB,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -16,13 +16,17 @@ export type { GeneratorDiagnostic, GeneratorDiagnosticCode } from './diagnostics
 export { GENERATOR_DIAGNOSTIC_CODES, generatorError, generatorWarning, withFile, } from './diagnostics.js';
 export type { DriftedFile, RegenerationAction, RegenerationOptions, RegenerationReport, RegenerationResult, RegenerationSink, } from './drift.js';
 export { checkDrift, formatRegenerationSummary, generatedFiles, hasDrift, planRegeneration, regenerate, staleGeneratedFiles, } from './drift.js';
+export type { EjectRequest, EjectResult, EjectStatus, ManagedPathOptions } from './eject.js';
+export { businessPathFor, eject } from './eject.js';
 export type { EmitsAgainst, GeneratorManifest, GeneratorManifestInput, GeneratorOutput, ManifestParseResult, Orchestration, StructuredOutput, TracingBackend, } from './manifest.js';
 export { checkIRSupport, GENERATOR_MANIFEST_VERSION, managedRoots, ORCHESTRATIONS, parseManifest, parseManifestJson, STRUCTURED_OUTPUTS, supportsIR, TRACING_BACKENDS, targetCapabilityDeclarations, validateGeneratorSet, validateManifest, } from './manifest.js';
 export { createMemorySink, createNodeSink } from './node-sink.js';
 export type { FileOwner } from './ownership.js';
-export { DEFAULT_BUSINESS_DIR, DEFAULT_GENERATED_DIR, DEFAULT_MANIFEST_FILENAME, escapesRoot, isAbsolutePath, isBusinessPath, isGeneratedPath, isRelativePath, isReservedPath, normalizeRelativePath, ownerForPath, REJECTION_SUFFIX, rejectionPath, } from './ownership.js';
+export { DEFAULT_BUSINESS_DIR, DEFAULT_GENERATED_DIR, DEFAULT_MANIFEST_FILENAME, escapesRoot, isAbsolutePath, isBusinessPath, isGeneratedPath, isRelativePath, isReservedPath, isScaffoldPath, normalizeRelativePath, ownerForPath, REJECTION_SUFFIX, rejectionPath, SCAFFOLD_PREFIXES, } from './ownership.js';
 export type { GeneratedFile, Generator, GeneratorContext, Plan, PlanValidationOptions, } from './plan.js';
 export { isRecord, validatePlan } from './plan.js';
+export type { CiProfile, EvalProfile, EvalSuite } from './scaffold.js';
+export { ACTION_PINS, CI_WORKFLOW_PATH, cliRangeFor, EVALS_WORKFLOW_PATH, scaffoldCi, scaffoldEvals, } from './scaffold.js';
 export type { Version } from './semver.js';
 export { compareVersions, formatVersion, isValidRange, isValidVersion, parseRange, parseVersion, satisfies, } from './semver.js';
 export { PY_FASTAPI_MANIFEST, PY_FASTAPI_MANIFEST_INPUT, PY_FASTAPI_TARGET, phase0Generators, phase0TargetCapabilities, } from './targets.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,YAAY,EACV,WAAW,EACX,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,SAAS,GACV,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,aAAa,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAChG,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,qBAAqB,EACrB,SAAS,EACT,QAAQ,EACR,UAAU,EACV,QAAQ,EACR,YAAY,GACb,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AACrF,OAAO,EACL,0BAA0B,EAC1B,cAAc,EACd,gBAAgB,EAChB,QAAQ,GACT,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,WAAW,EACX,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,UAAU,EACV,yBAAyB,EACzB,cAAc,EACd,QAAQ,EACR,gBAAgB,EAChB,UAAU,EACV,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,YAAY,EACZ,iBAAiB,EACjB,sBAAsB,EACtB,eAAe,EACf,mBAAmB,EACnB,aAAa,EACb,gBAAgB,EAChB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,cAAc,EACd,0BAA0B,EAC1B,YAAY,EACZ,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,kBAAkB,EAClB,UAAU,EACV,gBAAgB,EAChB,4BAA4B,EAC5B,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAClE,YAAY,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,WAAW,EACX,cAAc,EACd,cAAc,EACd,eAAe,EACf,cAAc,EACd,cAAc,EACd,qBAAqB,EACrB,YAAY,EACZ,gBAAgB,EAChB,aAAa,GACd,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,aAAa,EACb,SAAS,EACT,gBAAgB,EAChB,IAAI,EACJ,qBAAqB,GACtB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACnD,YAAY,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACL,eAAe,EACf,aAAa,EACb,YAAY,EACZ,cAAc,EACd,UAAU,EACV,YAAY,EACZ,SAAS,GACV,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,YAAY,EACV,WAAW,EACX,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,SAAS,GACV,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,aAAa,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAChG,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,qBAAqB,EACrB,SAAS,EACT,QAAQ,EACR,UAAU,EACV,QAAQ,EACR,YAAY,GACb,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AACrF,OAAO,EACL,0BAA0B,EAC1B,cAAc,EACd,gBAAgB,EAChB,QAAQ,GACT,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,WAAW,EACX,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,UAAU,EACV,yBAAyB,EACzB,cAAc,EACd,QAAQ,EACR,gBAAgB,EAChB,UAAU,EACV,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACpD,YAAY,EACV,YAAY,EACZ,iBAAiB,EACjB,sBAAsB,EACtB,eAAe,EACf,mBAAmB,EACnB,aAAa,EACb,gBAAgB,EAChB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,cAAc,EACd,0BAA0B,EAC1B,YAAY,EACZ,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,kBAAkB,EAClB,UAAU,EACV,gBAAgB,EAChB,4BAA4B,EAC5B,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAClE,YAAY,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,WAAW,EACX,cAAc,EACd,cAAc,EACd,eAAe,EACf,cAAc,EACd,cAAc,EACd,cAAc,EACd,qBAAqB,EACrB,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,aAAa,EACb,SAAS,EACT,gBAAgB,EAChB,IAAI,EACJ,qBAAqB,GACtB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACnD,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,WAAW,EACX,mBAAmB,EACnB,UAAU,EACV,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACL,eAAe,EACf,aAAa,EACb,YAAY,EACZ,cAAc,EACd,UAAU,EACV,YAAY,EACZ,SAAS,GACV,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -12,10 +12,12 @@ export { AID_MANIFEST_VERSION, emptyAidManifest, manifestFor, manifestRecordFor,
 export { checkDeterminism, compareIds, DETERMINISM_PATTERNS, ensureTrailingNewline, GENERATED_BANNER_MARKER, generatedBanner, normalizeNewlines, normalizeText, scanForNonDeterminism, sha256Hex, sortById, sortByPath, stableId, stableSortBy, } from './determinism.js';
 export { GENERATOR_DIAGNOSTIC_CODES, generatorError, generatorWarning, withFile, } from './diagnostics.js';
 export { checkDrift, formatRegenerationSummary, generatedFiles, hasDrift, planRegeneration, regenerate, staleGeneratedFiles, } from './drift.js';
+export { businessPathFor, eject } from './eject.js';
 export { checkIRSupport, GENERATOR_MANIFEST_VERSION, managedRoots, ORCHESTRATIONS, parseManifest, parseManifestJson, STRUCTURED_OUTPUTS, supportsIR, TRACING_BACKENDS, targetCapabilityDeclarations, validateGeneratorSet, validateManifest, } from './manifest.js';
 export { createMemorySink, createNodeSink } from './node-sink.js';
-export { DEFAULT_BUSINESS_DIR, DEFAULT_GENERATED_DIR, DEFAULT_MANIFEST_FILENAME, escapesRoot, isAbsolutePath, isBusinessPath, isGeneratedPath, isRelativePath, isReservedPath, normalizeRelativePath, ownerForPath, REJECTION_SUFFIX, rejectionPath, } from './ownership.js';
+export { DEFAULT_BUSINESS_DIR, DEFAULT_GENERATED_DIR, DEFAULT_MANIFEST_FILENAME, escapesRoot, isAbsolutePath, isBusinessPath, isGeneratedPath, isRelativePath, isReservedPath, isScaffoldPath, normalizeRelativePath, ownerForPath, REJECTION_SUFFIX, rejectionPath, SCAFFOLD_PREFIXES, } from './ownership.js';
 export { isRecord, validatePlan } from './plan.js';
+export { ACTION_PINS, CI_WORKFLOW_PATH, cliRangeFor, EVALS_WORKFLOW_PATH, scaffoldCi, scaffoldEvals, } from './scaffold.js';
 export { compareVersions, formatVersion, isValidRange, isValidVersion, parseRange, parseVersion, satisfies, } from './semver.js';
 export { PY_FASTAPI_MANIFEST, PY_FASTAPI_MANIFEST_INPUT, PY_FASTAPI_TARGET, phase0Generators, phase0TargetCapabilities, } from './targets.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,qBAAqB,EACrB,SAAS,EACT,QAAQ,EACR,UAAU,EACV,QAAQ,EACR,YAAY,GACb,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,0BAA0B,EAC1B,cAAc,EACd,gBAAgB,EAChB,QAAQ,GACT,MAAM,kBAAkB,CAAC;AAS1B,OAAO,EACL,UAAU,EACV,yBAAyB,EACzB,cAAc,EACd,QAAQ,EACR,gBAAgB,EAChB,UAAU,EACV,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAWpB,OAAO,EACL,cAAc,EACd,0BAA0B,EAC1B,YAAY,EACZ,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,kBAAkB,EAClB,UAAU,EACV,gBAAgB,EAChB,4BAA4B,EAC5B,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAElE,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,WAAW,EACX,cAAc,EACd,cAAc,EACd,eAAe,EACf,cAAc,EACd,cAAc,EACd,qBAAqB,EACrB,YAAY,EACZ,gBAAgB,EAChB,aAAa,GACd,MAAM,gBAAgB,CAAC;AAQxB,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEnD,OAAO,EACL,eAAe,EACf,aAAa,EACb,YAAY,EACZ,cAAc,EACd,UAAU,EACV,YAAY,EACZ,SAAS,GACV,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,qBAAqB,EACrB,SAAS,EACT,QAAQ,EACR,UAAU,EACV,QAAQ,EACR,YAAY,GACb,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,0BAA0B,EAC1B,cAAc,EACd,gBAAgB,EAChB,QAAQ,GACT,MAAM,kBAAkB,CAAC;AAS1B,OAAO,EACL,UAAU,EACV,yBAAyB,EACzB,cAAc,EACd,QAAQ,EACR,gBAAgB,EAChB,UAAU,EACV,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAWpD,OAAO,EACL,cAAc,EACd,0BAA0B,EAC1B,YAAY,EACZ,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,kBAAkB,EAClB,UAAU,EACV,gBAAgB,EAChB,4BAA4B,EAC5B,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAElE,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,WAAW,EACX,cAAc,EACd,cAAc,EACd,eAAe,EACf,cAAc,EACd,cAAc,EACd,cAAc,EACd,qBAAqB,EACrB,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AAQxB,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEnD,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,WAAW,EACX,mBAAmB,EACnB,UAAU,EACV,aAAa,GACd,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,eAAe,EACf,aAAa,EACb,YAAY,EACZ,cAAc,EACd,UAAU,EACV,YAAY,EACZ,SAAS,GACV,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,cAAc,CAAC"}

package/dist/ownership.d.ts

@@ -1,14 +1,26 @@
 /**
  * Ownership and path rules (§8.3, §8.4, §10).
  *
- * The three-tier split is the whole reason regeneration is safe: `generated/` is
+ * The tier split is the whole reason regeneration is safe: `generated/` is
  * generator-owned and never hand-edited, `business/` is developer-owned and written
  * once, and the ownership of a path is decided by *where it lives*, not by what a
  * generator happens to say about it. Every path in a plan is normalized through this
  * module, so a generator cannot escape its own root or claim a business path as
  * generated (or the reverse).
+ *
+ * `scaffold` is the third tier: generator-authored content that lives *outside* the
+ * managed roots, which today means the repository's own CI workflows. It is written
+ * once and then belongs to the developer, so it is never recorded in the manifest --
+ * there is no hash to compare against, and claiming one would make every edit a drift
+ * conflict. The allowlist exists so that "outside the managed roots" does not become
+ * "anywhere": a generator may only reach paths it is explicitly permitted to own.
+ */
+export type FileOwner = 'generated' | 'business' | 'scaffold';
+/**
+ * The only path prefixes a generator may scaffold. A prefix, not a glob, so the check
+ * stays a string comparison and a generator cannot smuggle a nested escape past it.
  */
-export type FileOwner = 'generated' | 'business';
+export declare const SCAFFOLD_PREFIXES: readonly ['.github/workflows/'];
 export declare const DEFAULT_GENERATED_DIR = "generated";
 export declare const DEFAULT_BUSINESS_DIR = "business";
 /** The ownership manifest. Generator bookkeeping, so it is never a planned artifact. */
@@ -35,6 +47,11 @@ export declare function ownerForPath(path: string, options?: {
     generatedDir?: string;
     businessDir?: string;
 }): FileOwner | undefined;
+/**
+ * True for a path inside the scaffold allowlist. Requires a file name after the
+ * prefix: `.github/workflows/` itself is the directory, not a workflow.
+ */
+export declare function isScaffoldPath(path: string): boolean;
 export declare function isGeneratedPath(path: string, options?: {
     generatedDir?: string;
     businessDir?: string;

package/dist/ownership.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ownership.d.ts","sourceRoot":"","sources":["../src/ownership.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG,UAAU,CAAC;AAEjD,eAAO,MAAM,qBAAqB,cAAc,CAAC;AACjD,eAAO,MAAM,oBAAoB,aAAa,CAAC;AAE/C,wFAAwF;AACxF,eAAO,MAAM,yBAAyB,sBAAsB,CAAC;AAE7D,uFAAuF;AACvF,eAAO,MAAM,gBAAgB,aAAa,CAAC;AAE3C;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUtE;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,qFAAqF;AACrF,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGjD;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGpD;AAUD;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GAC5D,SAAS,GAAG,SAAS,CAUvB;AAED,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GAC5D,OAAO,CAET;AAED,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GAC5D,OAAO,CAET;AAED,uFAAuF;AACvF,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,uFAAuF;AACvF,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAI9E"}
+{"version":3,"file":"ownership.d.ts","sourceRoot":"","sources":["../src/ownership.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG,UAAU,GAAG,UAAU,CAAC;AAE9D;;;GAGG;AACH,eAAO,MAAM,iBAAiB,YAAI,oBAAoB,CAAU,CAAC;AAEjE,eAAO,MAAM,qBAAqB,cAAc,CAAC;AACjD,eAAO,MAAM,oBAAoB,aAAa,CAAC;AAE/C,wFAAwF;AACxF,eAAO,MAAM,yBAAyB,sBAAsB,CAAC;AAE7D,uFAAuF;AACvF,eAAO,MAAM,gBAAgB,aAAa,CAAC;AAE3C;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUtE;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,qFAAqF;AACrF,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGjD;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGpD;AAUD;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GAC5D,SAAS,GAAG,SAAS,CAWvB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMpD;AAED,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GAC5D,OAAO,CAET;AAED,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GAC5D,OAAO,CAET;AAED,uFAAuF;AACvF,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,uFAAuF;AACvF,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAI9E"}

package/dist/ownership.js

@@ -1,13 +1,25 @@
 /**
  * Ownership and path rules (§8.3, §8.4, §10).
  *
- * The three-tier split is the whole reason regeneration is safe: `generated/` is
+ * The tier split is the whole reason regeneration is safe: `generated/` is
  * generator-owned and never hand-edited, `business/` is developer-owned and written
  * once, and the ownership of a path is decided by *where it lives*, not by what a
  * generator happens to say about it. Every path in a plan is normalized through this
  * module, so a generator cannot escape its own root or claim a business path as
  * generated (or the reverse).
+ *
+ * `scaffold` is the third tier: generator-authored content that lives *outside* the
+ * managed roots, which today means the repository's own CI workflows. It is written
+ * once and then belongs to the developer, so it is never recorded in the manifest --
+ * there is no hash to compare against, and claiming one would make every edit a drift
+ * conflict. The allowlist exists so that "outside the managed roots" does not become
+ * "anywhere": a generator may only reach paths it is explicitly permitted to own.
+ */
+/**
+ * The only path prefixes a generator may scaffold. A prefix, not a glob, so the check
+ * stays a string comparison and a generator cannot smuggle a nested escape past it.
  */
+export const SCAFFOLD_PREFIXES = ['.github/workflows/'];
 export const DEFAULT_GENERATED_DIR = 'generated';
 export const DEFAULT_BUSINESS_DIR = 'business';
 /** The ownership manifest. Generator bookkeeping, so it is never a planned artifact. */
@@ -68,8 +80,20 @@ export function ownerForPath(path, options = {}) {
         return 'generated';
     if (normalized === businessDir || normalized.startsWith(`${businessDir}/`))
         return 'business';
+    if (isScaffoldPath(normalized))
+        return 'scaffold';
     return undefined;
 }
+/**
+ * True for a path inside the scaffold allowlist. Requires a file name after the
+ * prefix: `.github/workflows/` itself is the directory, not a workflow.
+ */
+export function isScaffoldPath(path) {
+    const normalized = normalizeRelativePath(path);
+    if (normalized === undefined)
+        return false;
+    return SCAFFOLD_PREFIXES.some((prefix) => normalized.startsWith(prefix) && normalized.length > prefix.length);
+}
 export function isGeneratedPath(path, options = {}) {
     return ownerForPath(path, options) === 'generated';
 }

package/dist/ownership.js.map

@@ -1 +1 @@
-{"version":3,"file":"ownership.js","sourceRoot":"","sources":["../src/ownership.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,MAAM,CAAC,MAAM,qBAAqB,GAAG,WAAW,CAAC;AACjD,MAAM,CAAC,MAAM,oBAAoB,GAAG,UAAU,CAAC;AAE/C,wFAAwF;AACxF,MAAM,CAAC,MAAM,yBAAyB,GAAG,mBAAmB,CAAC;AAE7D,uFAAuF;AACvF,MAAM,CAAC,MAAM,gBAAgB,GAAG,UAAU,CAAC;AAE3C;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAChD,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACrC,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAEnD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,CAAC,CAAC;IAC3F,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAE9C,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,qBAAqB,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;AACnD,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5D,OAAO,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,OAAO,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAClG,CAAC;AAED;wFACwF;AACxF,SAAS,oBAAoB,CAAC,KAAa;IACzC,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IACvB,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG;QAAE,GAAG,EAAE,CAAC;IAChD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC1B,IAAY,EACZ,OAAO,GAAoD,EAAE;IAE7D,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE/C,MAAM,YAAY,GAAG,oBAAoB,CAAC,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAC,CAAC;IACzF,MAAM,WAAW,GAAG,oBAAoB,CAAC,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC,CAAC;IAEtF,IAAI,UAAU,KAAK,YAAY,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,YAAY,GAAG,CAAC;QAAE,OAAO,WAAW,CAAC;IACjG,IAAI,UAAU,KAAK,WAAW,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,WAAW,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC;IAC9F,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,OAAO,GAAoD,EAAE;IAE7D,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,WAAW,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,OAAO,GAAoD,EAAE;IAE7D,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,UAAU,CAAC;AACpD,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,GAAG,IAAI,GAAG,gBAAgB,EAAE,CAAC;AACtC,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,gBAAwB;IACnE,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC3C,OAAO,UAAU,KAAK,gBAAgB,IAAI,UAAU,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;AAClF,CAAC"}
+{"version":3,"file":"ownership.js","sourceRoot":"","sources":["../src/ownership.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,oBAAoB,CAAU,CAAC;AAEjE,MAAM,CAAC,MAAM,qBAAqB,GAAG,WAAW,CAAC;AACjD,MAAM,CAAC,MAAM,oBAAoB,GAAG,UAAU,CAAC;AAE/C,wFAAwF;AACxF,MAAM,CAAC,MAAM,yBAAyB,GAAG,mBAAmB,CAAC;AAE7D,uFAAuF;AACvF,MAAM,CAAC,MAAM,gBAAgB,GAAG,UAAU,CAAC;AAE3C;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAChD,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACrC,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAEnD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,CAAC,CAAC;IAC3F,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAE9C,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,qBAAqB,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;AACnD,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5D,OAAO,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,OAAO,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAClG,CAAC;AAED;wFACwF;AACxF,SAAS,oBAAoB,CAAC,KAAa;IACzC,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IACvB,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG;QAAE,GAAG,EAAE,CAAC;IAChD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC1B,IAAY,EACZ,OAAO,GAAoD,EAAE;IAE7D,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE/C,MAAM,YAAY,GAAG,oBAAoB,CAAC,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAC,CAAC;IACzF,MAAM,WAAW,GAAG,oBAAoB,CAAC,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC,CAAC;IAEtF,IAAI,UAAU,KAAK,YAAY,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,YAAY,GAAG,CAAC;QAAE,OAAO,WAAW,CAAC;IACjG,IAAI,UAAU,KAAK,WAAW,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,WAAW,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC;IAC9F,IAAI,cAAc,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,CAAC;IAClD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC3C,OAAO,iBAAiB,CAAC,IAAI,CAC3B,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAC/E,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,OAAO,GAAoD,EAAE;IAE7D,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,WAAW,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,OAAO,GAAoD,EAAE;IAE7D,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,UAAU,CAAC;AACpD,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,GAAG,IAAI,GAAG,gBAAgB,EAAE,CAAC;AACtC,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,gBAAwB;IACnE,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC3C,OAAO,UAAU,KAAK,gBAAgB,IAAI,UAAU,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;AAClF,CAAC"}

package/dist/scaffold.d.ts

@@ -0,0 +1,104 @@
+/**
+ * Scaffold content: generator-authored files that live outside the managed roots (§6a).
+ *
+ * Today that is the repository's own CI. It is planned like any other file, but it is
+ * written once and then belongs to the developer: `aid gen` never overwrites it, never
+ * records it in the manifest, and `aid eject` reports it as already owned. That split is
+ * what makes a generated workflow usable -- CI has to be edited for a runner, a
+ * credential, or a second toolchain, and every one of those edits would otherwise be a
+ * drift conflict against a file the developer is supposed to own.
+ *
+ * The emitted workflow deliberately contains **no** `apply` step and no cloud keys: it
+ * gates the repository and stops there. Deployment stays a human action, per §12.6.
+ */
+import type { GeneratedFile } from './plan.js';
+/** The repository CI: the spec gates, then lint/build/test for the app tier. */
+export declare const CI_WORKFLOW_PATH = ".github/workflows/ci.yml";
+/**
+ * The eval gate. A separate workflow because it needs a model credential and therefore
+ * cannot be a required check on a fork pull request: it runs on `workflow_dispatch` and
+ * nightly, and reports a skip -- not a pass -- when the credential is absent.
+ */
+export declare const EVALS_WORKFLOW_PATH = ".github/workflows/evals.yml";
+/**
+ * Action pins. A tag is mutable; a SHA is not, and a generated workflow that runs
+ * `@v4` is one force-push away from running different code than it did last week.
+ * These are the commits the `v4`/`v5` tags resolved to when this was written.
+ */
+export declare const ACTION_PINS: {
+    readonly checkout: 'actions/checkout@11d5960a326750d5838078e36cf38b85af677262';
+    readonly setupNode: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020';
+    readonly setupPython: 'actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065';
+};
+export interface CiProfile {
+    /** The target name, used in the workflow's title so a reader knows what generated it. */
+    readonly target: string;
+    /** Spec path relative to the repository root. */
+    readonly specPath: string;
+    /**
+     * The file that proves the app tier has dependencies to install.
+     * When it is absent the build job is *skipped*, not green: the repository has a spec
+     * but no application yet, and a check that passes because it never ran is the failure
+     * mode §6a exists to prevent.
+     */
+    readonly dependencyManifest: string;
+    /** Steps that put the language toolchain on the runner, as prepared YAML lines. */
+    readonly toolchain: readonly string[];
+    /** Shell lines that install the app's dependencies. */
+    readonly install: readonly string[];
+    /** Shell lines for lint/format. */
+    readonly lint: readonly string[];
+    /** Shell line for the type check or build. */
+    readonly build: string;
+    /** Shell line for the unit tests. */
+    readonly test: string;
+}
+/** One generated eval module and the command that runs it from the project root. */
+export interface EvalSuite {
+    readonly id: string;
+    readonly command: string;
+}
+export interface EvalProfile {
+    /** The target name, used in the workflow's title so a reader knows what generated it. */
+    readonly target: string;
+    /** Spec path relative to the repository root. */
+    readonly specPath: string;
+    /** Steps that put the language toolchain on the runner, as prepared YAML lines. */
+    readonly toolchain: readonly string[];
+    /** Shell lines that install the app's dependencies. */
+    readonly install: readonly string[];
+    /** The CI-gated evals, in declaration order. Never empty when a workflow is emitted. */
+    readonly suites: readonly EvalSuite[];
+    /**
+     * Environment variables the generated gateway reads a model key from. When this is
+     * empty every model is a fake, so the gate runs unguarded. When it is not, the gate is
+     * skipped with a warning unless every one of them is set: a real model behind a gate
+     * cannot be measured without its credential.
+     */
+    readonly secrets: readonly string[];
+}
+/** `major.minor` of a semver string, used to pin the CLI a workflow installs. */
+export declare function cliRangeFor(version: string): string;
+/**
+ * The CI workflow for a generated project.
+ *
+ * The spec gates are the framework's own contract and always run. The app job needs the
+ * project's dependency manifest, and a job-level `if` cannot call `hashFiles`, so a small
+ * `detect` job probes for the file and the app job is skipped -- not green -- without it.
+ * The infra job is skipped the same way when `infra/` is absent, and it only compares the
+ * committed tree against the spec: `plan`/`apply` need credentials and stay human actions.
+ */
+export declare function scaffoldCi(profile: CiProfile, cliRange: string): GeneratedFile;
+/**
+ * The eval gate for a project whose spec declares `gate.ci: true` evals.
+ *
+ * It never runs on `pull_request`. The generated evals measure a real model: with no
+ * credential the gateway falls back to the fake provider, whose output does not satisfy
+ * the eval's JSON schema, and the gate fails. Requiring the key on PRs would therefore
+ * either leak a secret to forks or turn the gate red for every contributor, so the gate
+ * runs on `workflow_dispatch` and nightly instead, and a missing key is an **error**
+ * rather than a silent skip: a gate that is green because it never ran is the failure
+ * mode this whole tier exists to avoid.
+ */
+export declare function scaffoldEvals(profile: EvalProfile): GeneratedFile;
+//# sourceMappingURL=scaffold.d.ts.map

package/dist/scaffold.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scaffold.d.ts","sourceRoot":"","sources":["../src/scaffold.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE/C,gFAAgF;AAChF,eAAO,MAAM,gBAAgB,6BAA6B,CAAC;AAE3D;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,gCAAgC,CAAC;AAEjE;;;;GAIG;AACH,eAAO,MAAM,WAAW;aACtB,QAAQ,EAAE,2DAA2D;aACrE,SAAS,EAAE,6DAA6D;aACxE,WAAW,EAAE,+DAA+D;CACpE,CAAC;AAEX,MAAM,WAAW,SAAS;IACxB,yFAAyF;IACzF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iDAAiD;IACjD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,mFAAmF;IACnF,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,uDAAuD;IACvD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,mCAAmC;IACnC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,qCAAqC;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,oFAAoF;AACpF,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B,yFAAyF;IACzF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iDAAiD;IACjD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,mFAAmF;IACnF,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,uDAAuD;IACvD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,wFAAwF;IACxF,QAAQ,CAAC,MAAM,EAAE,SAAS,SAAS,EAAE,CAAC;IACtC;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,iFAAiF;AACjF,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGnD;AAMD;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,aAAa,CA2G9E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,WAAW,GAAG,aAAa,CAqFjE"}